Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying
Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session…
Structure cloud IAM with role-based access, short-lived credentials, and permission boundaries that hold at scale.
IAM least privilege gap. Defense-only Security OS skill. Use for ASSESS-ONLY gap/control work.
Fetches raw IAM recommendations and associated security insights from Google Cloud for a specified target scope (Organization, Folder, or Project).
AWS IAM（Identity and Access Management）のセキュリティ設計パターン。最小権限の原則に基づく ポリシー設計、IAMロールの構成、クロスアカウントアクセス、条件キーによるアクセス制御、 サービスリンクロール、権限境界（Permissions Boundary）を網羅する。…
Internationales Handelsrecht und Lex Mercatoria: Warentransit Und Gefahruebergang. Geführter Spezialskill mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Image editing for agents: image-to-image edits, variations, and image-conditioned transforms through Image Skill's zero-setup hosted runtime.
Image-to-3D asset creation for agents through Image Skill's zero-setup hosted runtime. Use when an input image should become a durable hosted 3D mesh asset, such as a glb, without…
Use ImagineVid's OAuth-protected MCP and CLI tools to discover and safely run current image, video, and music generation capabilities.
Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0,
Implements Delinea Secret Server for privileged access management (PAM) including secret vault configuration,
Implements FIDO2/WebAuthn hardware security key authentication including registration ceremonies, authentication
Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for
Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators. Covers WebAuthn
Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across
Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates
Perform Five Forces analysis — competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants.
WHEN: Infrastructure security audit, secrets management, network policies, compliance checks WHAT: Secrets scanning + Network policies + IAM/RBAC audit + Compliance validation +…
Drafting tool-verified answers to cyber-insurance renewal, new-business, and underwriter security questionnaires: the standard recurring question set (MFA everywhere including…
Integra um banco, instituição de pagamento ou lotérica com a API do Boleto Ringer da Conta Comigo Digital (digitalbank 2.0): login OAuth2, cadastro de pessoa pagadora, webhook de…
Integrates a THIRD-PARTY identity provider via OpenID Connect — "Log in with Google/GitHub/Microsoft/Apple" or acting as an OAuth client to a third-party API.
Use when managing Connected Apps for integration purposes — configuring OAuth policies, IP restrictions, refresh token expiry, and monitoring connected app usage.
Guide for creating new OAuth-based integrations in the Orient codebase. Use when adding external service integrations (APIs like Linear, GitHub, Slack, Notion, etc.), implementing…
Use when designing a reusable integration layer in Salesforce that serves multiple external APIs through a shared callout infrastructure.
Architecture-layer guidance for securing Salesforce integrations: mTLS mutual authentication, OAuth 2.0 flow selection, API gateway placement, IP allowlisting strategy on…
Implement OAuth flows and manage credentials for external services (Google, Slack, Salesforce, etc.) through Interactor.
Install and configure Intercom API authentication with access tokens or OAuth. Use when setting up a new Intercom integration, configuring API credentials, or initializing the…
Apply Intercom security best practices for tokens, webhook verification, and scopes. Use when securing access tokens, implementing webhook signature validation, or configuring…
Draft evidence-backed applications for interim injunctions, stays, preservation, disclosure, security, attachment, receivership, interim payment, or other temporary relief.
Check a Microsoft Intune estate against a device baseline from read-only Graph exports, reporting non-compliant, stale, unencrypted, jailbroken and outdated devices, personal…
One-shot Base-token investigation - runs any subset of six onchain-security checks (rug-scan, contract-audit, deployer-trace, holder-concentration, honeypot, lp-lock) into one…
Design and implement Salesforce Login Flows (Screen Flows assigned to profiles or Experience Cloud sites) that run post-authentication to enforce conditional MFA, IP-based…
Implements Jakarta Security Enterprise API (JSR 375) for Jakarta EE applications with IdentityStore patterns, JWT Bearer tokens, form login, BCrypt password hashing, and container…
Secure P2P communication for AI agents. Noise XX handshake, XChaCha20-Poly1305 encryption, connection consent, human verification. Zero central servers.
使用 John the Ripper 进行离线密码破解。当需要破解哈希（MD5/SHA/NTLM/Kerberos/ZIP/RAR/PDF/SSH Key 等）时使用。John 支持自动检测哈希类型、字典攻击、规则变形、增量爆破，内置 *2john 工具链从各种格式提取哈希。任何涉及离线密码破解、哈希还原、密码审计的场景都应使用此技能
Centralized JSON validation for AGENT_SUCCESS_CRITERIA with defensive parsing and injection attack prevention (CVSS 8.2)
Audit JWT implementation for algorithm confusion, secret weakness, claim validation issues, and token handling vulnerabilities. Use when reviewing authentication systems using JWT.
Detect JWT implementation vulnerabilities including algorithm confusion, none algorithm acceptance, weak secrets, and JWK injection attacks.
Comprehensive JWT authentication expert for senior developers (10+ years experience). Intelligently detects project language/framework and implements production-ready JWT auth…
Full JWT attack methodology — alg:none, RS256-to-HS256 confusion, weak secret brute-force, kid injection, jku/jwk injection, and claim tampering.
Decode and security-audit a JSON Web Token — flag alg=none, missing/excessive expiry, symmetric-alg confusion risk, missing claims — and attempt an offline HMAC secret crack…
JWT/JWS/JWE token patterns for Swarm Bus agent identity. Sign JWTs with ES256/RS256, verify claims, encrypt payloads with JWE (A256GCM), short-lived token rotation, and…
Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage
Comprehensive JWT token security testing including signature verification, expiration checks, algorithm confusion attacks, and claim validation.
Jwt Token Validator - Auto-activating skill for Security Fundamentals. Triggers on: jwt token validator, jwt token validator Part of the Security Fundamentals skill category.
Execute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline.
Kerberos-based Active Directory attacks driven by hand with standard tooling (Kerberoasting, AS-REP roasting, and delegation abuse: unconstrained, constrained/S4U, RBCD).
Provides comprehensive KeyCloak administration guidance including realm management, user/group administration, client configuration, authentication flows, identity brokering,…
OpenStack Keystone identity service skill for deploying, configuring, operating, and troubleshooting the authentication and authorization backbone of an OpenStack cloud.
Apply Klaviyo security best practices for API key management and access control. Use when securing API keys, configuring OAuth scopes, implementing webhook signature verification,…
Kubernetes security policies, RBAC, and Pod Security Standards for hardened cluster deployments. Use when implementing cluster security, defining network policies, or enforcing…
Leasingrecht: Inkasso Leasingforderung mit geführtem Workflow, Normencheck, Beweis- und Fristenlogik, Red-Team und verwertbarem Ergebnis.
libsecret - Secret generation and environment utilities. generateSecret creates cryptographic random secrets. generateSecretB64 creates base64url secrets.
Configure enterprise role-based access control for Lindy AI workspaces. Use when setting up team permissions, managing workspace access, or implementing enterprise security…
Secure API key management, OAuth best practices, and webhook verification for Linear integrations. Trigger: "linear security", "linear API key security", "linear OAuth", "secure…
Full LinkedIn OAuth setup for minipostiz-cli — creates app, gets access token + personUrn, stores credentials
Authentication and authorization patterns including OAuth2, JWT, RBAC/ABAC, session management, API keys, password hashing, and MFA.
Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional…
Madrid-Protokoll WIPO und internationale Registrierung: DE/EU als Basismarke, Subsequent Designations US/JP/CN/GB, Section 66(a)-Application beim USPTO, Central Attack Period 5…